Brief Summary

Testing an Oracle database server can be very beneficial to the security of the application. It is common that the database port (E.g. 1521) is protected by the firewall but can be accessible on the internal LAN. If the Oracle database is not hardened internal "insider attacks" may occur.

Gray Box testing and example

The FAILED_LOGIN_ATTEMPTS parameter is used to limit to the number of failed login attempts allowed before a user account is locked by the data base.

FAILED_LOGIN_ATTEMPTS can be set to a specific number of attempts; to UNLIMITED (never lock an account), to DEFAULT, which refers to the value indicated in the DEFAULT profile.

Setting this value reduces the potential success of a brute force attack and alerts. Once an account is locked it can not be logged into for a defined number of days or until the administrator unlocks the account.